/// <summary> /// The start detection. /// </summary> /// <param name="action"> /// The detection Action. /// </param> public void StartDetection(Action action) { ThreadPool.QueueUserWorkItem( delegate { this.detectionAction = action; var options = new ConnectionOptions { EnablePrivileges = true }; var scope = new ManagementScope(@"root\CIMV2", options); try { var query = new WqlEventQuery { EventClassName = "__InstanceModificationEvent", WithinInterval = TimeSpan.FromSeconds(1), Condition = @"TargetInstance ISA 'Win32_LogicalDisk' and TargetInstance.DriveType = 5" // DriveType - 5: CDROM }; this.watcher = new ManagementEventWatcher(scope, query); this.watcher.EventArrived += this.WatcherEventArrived; this.watcher.Start(); } catch (Exception e) { Console.WriteLine(e.Message); } }); }
private void AddInsertUSBHandler() { WqlEventQuery query; ManagementScope scope = new ManagementScope("root\\CIMV2"); scope.Options.EnablePrivileges = true; insertUSBWatcher = null; try { query = new WqlEventQuery(); query.EventClassName = "__InstanceCreationEvent"; query.WithinInterval = new TimeSpan(0, 0, 3); query.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'"; insertUSBWatcher = new ManagementEventWatcher(scope, query); insertUSBWatcher.EventArrived += USBInserted; insertUSBWatcher.Start(); } catch(Exception e) { if (insertUSBWatcher != null) { insertUSBWatcher.Stop(); } throw e; } }
public ProcessWatcher(TaskScheduler scheduler, params string[] processNames) { Scheduler = scheduler; foreach (var pname in processNames) { var invariant = Path.GetFileNameWithoutExtension(pname).ToLowerInvariant(); ProcessNames.Add(invariant); foreach (var process in Process.GetProcessesByName(invariant)) { RunningProcessIds.Add(process.Id); NewProcesses.Enqueue(process); } } try { var query = new WqlEventQuery(@"SELECT * FROM Win32_ProcessStartTrace"); Watcher = new ManagementEventWatcher(query); Watcher.Options.BlockSize = 1; Watcher.EventArrived += new EventArrivedEventHandler(OnEventArrived); Watcher.Start(); WatcherEnabled = true; } catch { Watcher = null; WatcherEnabled = false; TimerTask = Scheduler.Start(InitTimer(), TaskExecutionPolicy.RunAsBackgroundTask); } }
public void AddProcessStopEventHandler(string processName, Action handler) { WqlEventQuery query = new WqlEventQuery(PROCESS_INSTANCE_DELETION_EVENT, _eventQueryWithinInterval, string.Format(PROCESS_QUERY_CONDITION, processName)); _watchers.Add(StartNewWatcher(query, handler)); }
public UsbDeviceEvent() { this.creationEventWatcher = (ManagementEventWatcher)null; ManagementOperationObserver operationObserver = new ManagementOperationObserver(); ManagementScope scope = new ManagementScope("root\\CIMV2"); scope.Options.EnablePrivileges = true; try { WqlEventQuery wqlEventQuery = new WqlEventQuery(); wqlEventQuery.EventClassName = "__InstanceCreationEvent"; wqlEventQuery.WithinInterval = new TimeSpan(0, 0, 3); wqlEventQuery.Condition = "TargetInstance ISA 'Win32_USBControllerDevice'"; Console.WriteLine(wqlEventQuery.QueryString); this.creationEventWatcher = new ManagementEventWatcher(scope, (EventQuery)wqlEventQuery); this.creationEventWatcher.EventArrived += new EventArrivedEventHandler(this.creationEventWatcher_EventArrived); this.creationEventWatcher.Start(); wqlEventQuery.EventClassName = "__InstanceDeletionEvent"; wqlEventQuery.WithinInterval = new TimeSpan(0, 0, 3); wqlEventQuery.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'"; Console.WriteLine(wqlEventQuery.QueryString); this.deletionEventWatcher = new ManagementEventWatcher(scope, (EventQuery)wqlEventQuery); this.deletionEventWatcher.EventArrived += new EventArrivedEventHandler(this.deletionEventWatcher_EventArrived); this.deletionEventWatcher.Start(); } catch { this.Dispose(); } }
private void MainWindow1_Initialized(object sender, EventArgs e) { BackgroundWorker detect = new BackgroundWorker(); detect.DoWork += new DoWorkEventHandler(detect_work); detect.RunWorkerAsync(); queryadd = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2"); watcheradd.EventArrived += new EventArrivedEventHandler(watcher_deviceadded); watcheradd.Query = queryadd; watcheradd.Start(); queryremove = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 3"); watcherremove.EventArrived += new EventArrivedEventHandler(watcher_deviceremoved); watcherremove.Query = queryremove; watcherremove.Start(); if (queryadd.Equals(true)) { watcherremove.Stop(); watcherremove.Start(); } if (queryremove.Equals(true)) { watcherremove.Stop(); watcherremove.Start(); } }
static void Main(string[] args) { ManagementEventWatcher w1; ManagementEventWatcher w2; ManagementEventWatcher w3; ManagementEventWatcher w4; WqlEventQuery q1 = new WqlEventQuery("select * from __instanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' "); w1 = new ManagementEventWatcher(q1); w1.EventArrived += new EventArrivedEventHandler(WriteStarted); WqlEventQuery q2 = new WqlEventQuery("select * from __instanceDeletionEvent WITHIN 1 WHERE TargetInstance ISA 'win32_share' and TargetInstance.name = 'Pop-Music' "); w2 = new ManagementEventWatcher(q2); w2.EventArrived += new EventArrivedEventHandler(WriteFinished); WqlEventQuery q3 = new WqlEventQuery("SELECT * FROM RegistryKeyChangeEvent WHERE Hive = 'HKEY_LOCAL_MACHINE'" + @" AND KeyPath = 'SOFTWARE\\LAB4'"); w3 = new ManagementEventWatcher(q3); w3.EventArrived += new EventArrivedEventHandler(OnRegChanged); WqlEventQuery q4 = new WqlEventQuery("Select * From __InstanceOperationEvent Within 2 Where TargetInstance Isa 'CIM_DataFile' And TargetInstance.Drive='C:' And " + @"TargetInstance.Path='\\Lab4\\test\\'"); w4 = new ManagementEventWatcher(q4); w4.EventArrived += new EventArrivedEventHandler(OnFolderChanged); w1.Start(); w2.Start(); w3.Start(); w4.Start(); System.Threading.Thread.Sleep(300000); }
public static void Run() { // Create event query to be notified within 1 second of // a new process being created WqlEventQuery query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\""); // Initialize an event watcher and subscribe to events // that match this query ManagementEventWatcher watcher = new ManagementEventWatcher(query); // times out watcher.WaitForNextEvent in 5 seconds watcher.Options.Timeout = new TimeSpan(0, 0, 5); // Block until the next event occurs // Note: this can be done in a loop if waiting for // more than one occurrence Console.WriteLine( "Open an application (notepad.exe) to trigger an event."); ManagementBaseObject e = watcher.WaitForNextEvent(); log.Debug(e.GetText(TextFormat.Mof )); ManagementBaseObject target = (ManagementBaseObject)e["TargetInstance"]; Object targetName = target["Name"]; Object targetPath = target["ExecutablePath"]; //Display information from the event log.Info( "Process {0} has been created, path is: " + targetName + ", " + targetPath); //Cancel the subscription watcher.Stop(); }
static void AddRemoveUSBHandler() { WqlEventQuery q; try { q = new WqlEventQuery(); q.EventClassName = "__InstanceDeletionEvent"; q.WithinInterval = pollInterval; //q.Condition = "TargetInstance ISA 'Win32_USBControllerdevice'"; q.Condition = "TargetInstance ISA 'Win32_PnPEntity'"; //w = new ManagementEventWatcher(scope, q); w = new ManagementEventWatcher(q); w.EventArrived += USBRemoved; w.Start(); } catch (Exception e) { Console.WriteLine(e.Message); if (w != null) { w.Stop(); } } }
public void StartWatcher() { try { ManagementScope managementScope = new ManagementScope("root\\CIMV2"); managementScope.Options.EnablePrivileges = true; const String query = @"TargetInstance ISA 'Win32_USBControllerDevice'"; WqlEventQuery wqlEventQuery = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), query); this.managementEventWatcherDeviceConnected = new ManagementEventWatcher(managementScope, wqlEventQuery); this.managementEventWatcherDeviceConnected.EventArrived += this.OnDeviceConnected; this.managementEventWatcherDeviceConnected.Start(); wqlEventQuery = new WqlEventQuery("__InstanceDeletionEvent", new TimeSpan(0, 0, 1), query); this.managementEventWatcherDeviceDisconnected = new ManagementEventWatcher(managementScope, wqlEventQuery); this.managementEventWatcherDeviceDisconnected.EventArrived += this.OnDeviceDisconnected; this.managementEventWatcherDeviceDisconnected.Start(); wqlEventQuery = new WqlEventQuery("__InstanceModificationEvent", new TimeSpan(0, 0, 1), query); this.managementEventWatcherDeviceModified = new ManagementEventWatcher(managementScope, wqlEventQuery); this.managementEventWatcherDeviceModified.EventArrived += this.OnDeviceModified; this.managementEventWatcherDeviceModified.Start(); } catch (Exception ex) { Tracer.Trace(ex, "Error starting WMI watcher"); } }
private void ListenForDeviceConnectionChanges() { var attachedDeviceQuery = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType=2"); var watcher = new ManagementEventWatcher(attachedDeviceQuery); watcher.EventArrived += ReAttachDeviceIfRequired; watcher.Start(); }
static void Main() { string currentPath = System.Environment.CurrentDirectory; Application.EnableVisualStyles(); Application.SetCompatibleTextRenderingDefault(false); iosSyslogger LoggerWindow = new iosSyslogger(); loggerTool tool = new loggerTool(); WqlEventQuery insertQuery = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2"); //Checking USB device insertion ManagementEventWatcher insertWatcher = new ManagementEventWatcher(insertQuery); WqlEventQuery removeQuery = new WqlEventQuery("SELECT * FROM __InstanceDeletionEvent WITHIN 2 WHERE TargetInstance ISA 'Win32_USBHub'"); //Checking USB removal ManagementEventWatcher removeWatcher = new ManagementEventWatcher(removeQuery); insertWatcher.EventArrived += new EventArrivedEventHandler((source, e) => DeviceInsertedEvent(source, e, LoggerWindow, tool)); insertWatcher.Start(); removeWatcher.EventArrived += new EventArrivedEventHandler((source, e) => DeviceRemovedEvent(source, e, LoggerWindow, tool)); removeWatcher.Start(); Thread loggerParentThread = new Thread(() => tool.readDeviceUUID(LoggerWindow, tool)); //Parent thread for Syslogger loggerParentThread.Start(); Application.Run(LoggerWindow); AppDomain.CurrentDomain.ProcessExit += new EventHandler(OnProcessExit); }
public ChooseForm () { InitializeComponent (); processView.ListViewItemSorter = new ProcessViewItemComparer (); usbDevView.ListViewItemSorter = new DeviceViewItemComparer (); processViewUpdater = new ProcessViewUpdater (processView); usbViewUpdater = new UsbViewUpdater (usbDevView); WqlEventQuery startQuery = new WqlEventQuery (); startQuery.EventClassName = "Win32_ProcessStartTrace"; WqlEventQuery stopQuery = new WqlEventQuery (); stopQuery.EventClassName = "Win32_ProcessStopTrace"; ManagementEventWatcher w = new ManagementEventWatcher (startQuery); w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived); w.Start(); processStartWatcher = w; w = new ManagementEventWatcher (stopQuery); w.EventArrived += new EventArrivedEventHandler (ProcessEventArrived); w.Start (); processStopWatcher = w; }
public Boolean AddUSBEventWatcher(EventArrivedEventHandler usbInsertHandler, EventArrivedEventHandler usbRemoveHandler, TimeSpan withinInterval) { try { ManagementScope Scope = new ManagementScope("root\\CIMV2"); Scope.Options.EnablePrivileges = true; if (usbInsertHandler != null) { WqlEventQuery InsertQuery = new WqlEventQuery("__InstanceCreationEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'"); insertWatcher = new ManagementEventWatcher(Scope, InsertQuery); insertWatcher.EventArrived += usbInsertHandler; insertWatcher.Start(); } if (usbRemoveHandler != null) { WqlEventQuery RemoveQuery = new WqlEventQuery("__InstanceDeletionEvent", withinInterval, "TargetInstance isa 'Win32_USBControllerDevice'"); removeWatcher = new ManagementEventWatcher(Scope, RemoveQuery); removeWatcher.EventArrived += usbRemoveHandler; removeWatcher.Start(); } return true; } catch (Exception) { RemoveUSBEventWatcher(); return false; } }
/// <exception cref="System.Security.SecurityException"> /// 当前用户没有访问监控器中项的许可时抛出。 /// </exception> /// <exception cref="System.ArgumentException"> /// 当监控器中的项不存在时抛出。 /// </exception> public RegistryWatcher(RegistryKey hive, string keyPath) { this.Hive = hive; this.KeyPath = keyPath; // 如果你把这个项目的平台设为x86,则在一个64位的机器上运行此项目时,当你的项路径 // 是HKEY_LOCAL_MACHINE\SOFTWARE时,你将会在HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node // 下找到注册表项。 this.KeyToMonitor = hive.OpenSubKey(keyPath); if (KeyToMonitor != null) { // 构造查询字符串。 string queryString = string.Format(@"SELECT * FROM RegistryKeyChangeEvent WHERE Hive = '{0}' AND KeyPath = '{1}' ", this.Hive.Name, this.KeyPath); WqlEventQuery query = new WqlEventQuery(); query.QueryString = queryString; query.EventClassName = "RegistryKeyChangeEvent"; query.WithinInterval = new TimeSpan(0, 0, 0, 1); this.Query = query; this.EventArrived += new EventArrivedEventHandler(RegistryWatcher_EventArrived); } else { string message = string.Format( @"注册表项 {0}\{1} 不存在。", hive.Name, keyPath); throw new ArgumentException(message); } }
public static ManagementEventWatcher GetWatcher(EventArrivedEventHandler handler) { WqlEventQuery query = new WqlEventQuery("__InstanceCreationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\""); ManagementEventWatcher watcher = new ManagementEventWatcher(query); watcher.EventArrived += new EventArrivedEventHandler(handler); return watcher; }
/// <summary> /// USB 插入和拔出监测函数。 /// 使用ManagementEventWacher来预定特定系统事件,通过WqlEventQuery设置查询对象和条件以及其他属性(比如查询的轮询间隔), /// 通过ManagementScope设置查询路径范围。 /// </summary> public void USBRemoveWacher() { ManagementEventWatcher wacher = null; WqlEventQuery query = null; ManagementScope scope = null; try { scope = new ManagementScope("root\\CIMV2"); //设置WMI路径 query = new WqlEventQuery(); //设置查询的事件类名,条件,查询间隔,也可一次在构造函数中初始化 query.EventClassName = "__InstanceDeletionEvent"; query.Condition = @"TargetInstance ISA 'Win32_USBControllerdevice'"; query.WithinInterval = new TimeSpan(1000); wacher = new ManagementEventWatcher(scope, query); wacher.EventArrived += new EventArrivedEventHandler(onUSBRemoved); wacher.Start(); } catch (Exception ex) { MessageBox.Show(ex.Message); } this.Closed += (s, e) => { wacher.Stop(); wacher.Dispose(); }; }
static PathUtility() { var combinedPath = Path.Combine("a", "b"); DefaultDirectorySeparator = combinedPath.Substring(1, combinedPath.Length - 2); //Insert WqlEventQuery q_creation = new WqlEventQuery(); q_creation.EventClassName = "__InstanceCreationEvent"; q_creation.WithinInterval = new TimeSpan(0, 0, 2); //How often do you want to check it? 2Sec. q_creation.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition'"; _mweCreation = new ManagementEventWatcher(q_creation); _mweCreation.EventArrived += UsbStorageInserted; _mweCreation.Start(); // Start listen for events //Remove WqlEventQuery q_deletion = new WqlEventQuery(); q_deletion.EventClassName = "__InstanceDeletionEvent"; q_deletion.WithinInterval = new TimeSpan(0, 0, 2); //How often do you want to check it? 2Sec. q_deletion.Condition = @"TargetInstance ISA 'Win32_DiskDriveToDiskPartition' "; _mweDeletion = new ManagementEventWatcher(q_deletion); _mweDeletion.EventArrived += UsbStorageRemoved; _mweDeletion.Start(); // Start listen for events Storage = _knownStorage; UpdateStorage(); }
public DriveService() { // Bind to local machine var options = new ConnectionOptions { EnablePrivileges = true }; var scope = new ManagementScope(@"root\CIMV2", options); try { var query = new WqlEventQuery { EventClassName = "__InstanceModificationEvent", WithinInterval = TimeSpan.FromSeconds(1), Condition = @"TargetInstance ISA 'Win32_LogicalDisk' and TargetInstance.DriveType = 5" // DriveType - 5: CDROM }; this.watcher = new ManagementEventWatcher(scope, query); // register async. event handler this.watcher.EventArrived += this.HandleDiscEvent; this.watcher.Start(); } catch (Exception e) { System.Diagnostics.Debug.WriteLine(e.Message); } }
private static void WaitForUSB() { ManagementEventWatcher watcher = new ManagementEventWatcher(); WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2"); watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); watcher.Query = query; watcher.Start(); }
private ManagementEventWatcher StartNewWatcher(WqlEventQuery query, Action handler) { var watcher = new ManagementEventWatcher { Query = query }; watcher.EventArrived += (s, e) => handler(); watcher.Start(); return watcher; }
private void InitializeWatcher() { _watcher = new ManagementEventWatcher(); var query = new WqlEventQuery("SELECT * FROM Win32_DeviceChangeEvent WHERE EventType = 2 or EventType = 3"); _watcher.EventArrived += WatcherOnEventArrived; _watcher.Query = query; _watcher.Start(); }
public DeviceEnumerationListener() { WqlEventQuery query = new WqlEventQuery("__InstanceOperationEvent", "TargetInstance ISA 'Win32_PnPEntity'") { WithinInterval = new TimeSpan(0, 0, 1) }; this.watcher = new ManagementEventWatcher(query); this.watcher.EventArrived += new EventArrivedEventHandler(this.watcher_EventArrived); this.watcher.Start(); }
public UsbWrapper() { WqlEventQuery q = new WqlEventQuery("__InstanceOperationEvent", "TargetInstance ISA 'Win32_LogicalDisk'"); q.WithinInterval = TimeSpan.FromSeconds(1); eventWatcher = new ManagementEventWatcher(q); eventWatcher.EventArrived += new EventArrivedEventHandler(OnUsbEvent); eventWatcher.Start(); App.Current.Exit += new ExitEventHandler(OnAppExit); }
private void StartWatchDeleteProcess() { WqlEventQuery query = new WqlEventQuery("__InstanceDeletionEvent", new TimeSpan(0, 0, 1), "TargetInstance isa \"Win32_Process\""); watch_del = new ManagementEventWatcher(query); watch_del.EventArrived += new EventArrivedEventHandler(HandleProcessDeleteEvent); watch_del.Start(); }
public DeviceListManager(ConfigurationManager configurationManager) { ConfigurationManager = configurationManager; ManagementEventWatcher = new ManagementEventWatcher(); WqlEventQuery query = new WqlEventQuery(DeviceChangeEventQuery); ManagementEventWatcher.EventArrived += Watcher_EventArrived; ManagementEventWatcher.Query = query; IsKeepRunning = false; }
public WMIWatcher(string eventClassName, string processName, Action<DateTime> notifyAction) { this.notifyAction = notifyAction; this.processName = processName; var q = new WqlEventQuery(); q.EventClassName = eventClassName; this.w = new ManagementEventWatcher(q); this.w.EventArrived += new EventArrivedEventHandler(ProcessStartEventArrived); this.w.Start(); }
public void Start(delegate_action action) { _action = action; _q = new WqlEventQuery("__InstanceOperationEvent", "TargetInstance ISA 'Win32_USBControllerDevice' "); _q.WithinInterval = TimeSpan.FromSeconds(1); _w = new ManagementEventWatcher(_q); _w.EventArrived += new EventArrivedEventHandler(onEventArrived); _w.Start(); }
public ProcWatchers() { //Hook WMI because its awesome watcher = new ManagementEventWatcher(); WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_ProcessStartTrace"); watcher.Query = query; watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived); watcher.Start(); w = Writer.getInstance(); builder = new StringBuilder(); }
public static void WatchDrives(Action handler) { using (var watcher = new ManagementEventWatcher()) { WqlEventQuery query = new WqlEventQuery("SELECT * FROM Win32_VolumeChangeEvent WHERE EventType = 2"); watcher.EventArrived += (e, sender) => handler(); watcher.Query = query; watcher.Start(); watcher.WaitForNextEvent(); } }
public static ManagementEventWatcher GetWatcher(EventArrivedEventHandler handler) { WqlEventQuery query = new WqlEventQuery("__InstanceModificationEvent", new TimeSpan(0, 0, 1), "TargetInstance isa 'Win32_LocalTime' AND TargetInstance.Second = 0"); ManagementEventWatcher watcher = new ManagementEventWatcher(query); watcher.EventArrived += new EventArrivedEventHandler(handler); return watcher; }
private void subscribeEvent(Threshold th) { string dirSymbol; if (th.Threshold_dir == Threshold_X_Dir.ABOVE_THRESHOLD) { dirSymbol = ">"; } else { dirSymbol = "<"; } wqlquery = new System.Management.WqlEventQuery("__InstanceModificationEvent" , new TimeSpan(0, 0, 1) , "TargetInstance isa \"Win32_NetworkAdapter\" AND TargetInstance.GUID='" + Information.GenericInfo.InterfaceGUID + "' AND TargetInstance.Speed " + dirSymbol + th.Threshold_Val); mw = new System.Management.ManagementEventWatcher(wqlquery); mw.EventArrived += new System.Management.EventArrivedEventHandler(mw_EventArrived); mw.Start(); }